CVE-2021-37391
MEDIUMChamilo Lms < 1.11.14 - XSS
Title source: ruleDescription
A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.
Exploits (1)
Scores
CVSS v3
5.4
EPSS
0.0056
EPSS Percentile
68.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
chamilo/chamilo_lms
1.11.0 - 1.11.14
Published
Aug 10, 2021
Tracked Since
Feb 18, 2026